CVE-2026-25718 — Vulnerability in code.gitea.io/gitea — CVE Details

CRITICAL

Gitea template repository generation follows unsafe filesystem paths

Published July 3, 2026Updated September 2, 2026Source: osv

Summary

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.

Advisory Timeline

First published July 3, 2026 (101 days ago).
Last revised September 2, 2026 — 61 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update code.gitea.io/gitea to 1.25.5 or later

go get code.gitea.io/gitea@v1.25.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
code.gitea.io/gitea	go	All versions	1.25.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-59
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-25718?: Gitea template repository generation follows unsafe filesystem paths This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-25718?: CVE-2026-25718 affects code.gitea.io/gitea. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-25718 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-h697-89cp-24q8

GO-2026-6340

Related CVEs

CVE-2026-22874
CRITICAL
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
CVE-2019-11576
CRITICAL
Gitea Allows 1FA Even for 2FA-Enrolled Accounts
CVE-2024-6886
CRITICAL
Gitea Cross-site Scripting Vulnerability
CVE-2026-26232
CRITICAL
Gitea OAuth2 authorization codes can be reused after expiry
CVE-2026-27775
HIGH
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
CVE-2026-56654
HIGH
Gitea: Privilege Escalation via Access Token Scope Escalation in API
CVE-2026-58424
HIGH
Gitea: Permanent Fork PR Workflow Approval Gate Bypass
CVE-2026-57894
HIGH
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies